Add code signing

Author: ndabas

build.ps1

@@ -77,9 +77,12 @@ mkdirp "bin"
     Write-Host $_.file
   }
 
-  if ($_ | Get-Member prebuild) {
-    $0 = $outfile
-    Invoke-Expression $_.prebuild
+  if ($_ | Get-Member dirName) {
+    $strip = 0;
+    if ($_ | Get-Member extractStrip) { $strip = $_.extractStrip }
+
+    mkdirp "build\$($_.dirName)" -clean
+    exec { tar -xf $outfile -C "build\$($_.dirName)" --strip-components $strip }
   }
 }
 
@@ -125,6 +128,13 @@ if (-not (Test-Path build\NSIS)) {
   Expand-Archive '.\downloads\nsis-log.zip' -DestinationPath '.\build\NSIS' -Force
 }
 
+function sign {
+  param ([string[]] $filesToSign)
+
+  $cert = Get-ChildItem -Path Cert:\CurrentUser\My -CodeSigningCert | Where-Object { $_.Subject -like "CN=Raspberry Pi*" }
+  $filesToSign | Set-AuthenticodeSignature -Certificate $cert -TimestampServer "http://timestamp.digicert.com" -HashAlgorithm SHA256
+}
+
 function msys {
   param ([string] $cmd)
 
@@ -366,9 +376,9 @@ Section "$($_.name)" Sec$($_.shortName)
 "@
   })
 
-  $(if ($_ | Get-Member copy) {
-    "SetOutPath '`$INSTDIR\$($_.copy)'`r`n"
-    "File /r build\$($_.copy)\*.*"
+  $(if ($_ | Get-Member dirName) {
+    "SetOutPath '`$INSTDIR\$($_.dirName)'`r`n"
+    "File /r build\$($_.dirName)\*.*"
   })
 
 SectionEnd
@@ -484,9 +494,19 @@ $env:__COMPAT_LAYER = "RunAsInvoker"
 exec { Start-Process -FilePath ".\build\build-uninstaller-$suffix.exe" -ArgumentList "/S /D=$PSScriptRoot\build" -Wait }
 $env:__COMPAT_LAYER = ""
 
+# Sign files before packaging up the installer
+sign "build\uninstall-$suffix.exe",
+"build\openocd-install\mingw$bitness\bin\openocd.exe",
+"build\pico-sdk-tools\mingw$bitness\elf2uf2.exe",
+"build\pico-sdk-tools\mingw$bitness\pioasm.exe",
+"build\picotool-install\mingw$bitness\picotool.exe"
+
 exec { .\build\NSIS\makensis ".\$basename-$suffix.nsi" }
 Write-Host "Installer saved to $binfile"
 
+# Sign the installer
+sign $binfile
+
 # Package OpenOCD separately as well
 
 $version = (cmd /c ".\build\openocd-install\mingw$bitness\bin\openocd.exe" --version '2>&1')[0]

config/x64-standalone.json

@@ -6,36 +6,33 @@
       "name": "GNU Arm Embedded Toolchain",
       "file": "gcc-arm-none-eabi-10.3-2021.10-win32.zip",
       "href": "https://developer.arm.com/-/media/Files/downloads/gnu-rm/10.3-2021.10/gcc-arm-none-eabi-10.3-2021.10-win32.zip?rev=8f4a92e2ec2040f89912f372a55d8cf3&hash=8A9EAF77EF1957B779C59EADDBF2DAC118170BBF",
-      "prebuild": "mkdirp build\\gcc-arm-none-eabi -clean && tar -xf $0 -C build\\gcc-arm-none-eabi --strip-components 1",
-      "copy": "gcc-arm-none-eabi"
+      "dirName": "gcc-arm-none-eabi",
+      "extractStrip": 1
     },
     {
       "name": "CMake",
       "file": "cmake-3.25.0-windows-x86_64.zip",
       "href": "https://github.com/Kitware/CMake/releases/download/v3.25.0/cmake-3.25.0-windows-x86_64.zip",
-      "prebuild": "mkdirp build\\cmake -clean && tar -xf $0 -C build\\cmake --strip-components 1",
-      "copy": "cmake"
+      "dirName": "cmake",
+      "extractStrip": 1
     },
     {
       "name": "Ninja",
       "file": "ninja-win.zip",
       "href": "https://github.com/ninja-build/ninja/releases/download/v1.11.1/ninja-win.zip",
-      "prebuild": "mkdirp build\\ninja -clean && tar -xf $0 -C build\\ninja",
-      "copy": "ninja"
+      "dirName": "ninja"
     },
     {
       "name": "Python 3.9",
       "file": "python-3.9.13-embed-amd64.zip",
       "href": "https://www.python.org/ftp/python/3.9.13/python-3.9.13-embed-amd64.zip",
-      "prebuild": "mkdirp build\\python -clean && tar -xf $0 -C build\\python",
-      "copy": "python"
+      "dirName": "python"
     },
     {
       "name": "Git for Windows",
       "file": "MinGit-2.38.1-64-bit.zip",
       "href": "https://github.com/git-for-windows/git/releases/download/v2.38.1.windows.1/MinGit-2.38.1-64-bit.zip",
-      "prebuild": "mkdirp build\\git -clean && tar -xf $0 -C build\\git",
-      "copy": "git"
+      "dirName": "git"
     },
     {
       "name": "Visual Studio Code",

config/x64.json

@@ -18,8 +18,7 @@
       "name": "Ninja",
       "file": "ninja-win.zip",
       "href": "https://github.com/ninja-build/ninja/releases/download/v1.11.1/ninja-win.zip",
-      "prebuild": "mkdirp build\\ninja -clean && tar -xf $0 -C build\\ninja",
-      "copy": "ninja"
+      "dirName": "ninja"
     },
     {
       "name": "Python 3.9",